The flaw resides in the uniphier SPI driver: during initialization the driver calls devm_request_irq() before the completion object used by the interrupt handler is initialized. If the device generates an interrupt immediately after the IRQ registration, the handler may call complete() on an uninitialized completion, leading to undefined behavior that can cause a kernel panic or memory corruption. This unsafe use of the completion construct has been identified by the Linux Kernel Address Sanitizer and can result in a denial‑of‑service condition by crashing the kernel.

All Linux kernel builds that include the uniphier SPI driver before the patch are affected. The version notice is not explicitly listed, so any kernel configuration that loads this driver from boot or dynamically before the commit that initializes the completion is potentially vulnerable. The issue applies to any system where the driver is enabled and the uniphier device is present.

The type of vulnerability is limited to environments where an interrupt can be triggered on the affected device, so the attack vector requires physical or local access to the hardware or a malicious firmware capable of manipulating the device. The CVSS score of 8.4 classifies it as high severity, but the EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog and no active exploits are currently known. Accordingly, the overall risk remains moderate; applying the recent kernel update eliminates the threat.